|  | 6.1 | Access Control Lists (ACLs)
| 6.1.2 | Reasons to create ACLs

There are many reasons to create ACLs. For example, ACLs can be used to: Limit network traffic and increase network performance. For example, ACLs can designate certain packets to be processed by a router before other traffic, on the basis of a protocol. This is referred to as queuing, which ensures that routers will not process packets that are not needed. As a result, queuing limits network traffic and reduces network congestion. Provide traffic flow control. For example, ACLs can restrict or reduce the contents of routing updates. These restrictions are used to limit information about specific networks from propagating through the network. Provide a basic level of security for network access. For example, ACLs can allow one host to access a part of your network and prevent another host from accessing the same area. Host A is allowed to access the Human Resources network, and Host B is prevented from accessing the Human Resources network. If you do not configure ACLs on your router, all packets passing through the router could be allowed onto all parts of the network. Decide which types of traffic are forwarded or blocked at the router interfaces. For example, you can permit e-mail traffic to be routed, but at the same time block all telnet traffic.
| Threaded Case Study
Washington Project: Using ACLs

When you use ACLs on the local site access routers, all traffic from the curriculum LANs should be prohibited on the administration LAN. You can make exceptions to this requirement by allowing applications, such as e-mail and directory services, to pass freely because they pose minimal risk.

E-mail and DNS need to be available throughout the district, and these types of services should not allow any unauthorized access to the administration network. All the ACLs you create need to be controlled at the district office, and you need to review exceptions to the ACLs prior to implementation.

| Web Links
| Cisco Connection Online
| Cisco Documentation
| Search Cisco